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Abstract. - In this paper, we present the first experimental demonstration on continuous variable 
quantum key distribution using determinant Einstein-Podolsky-Rosen entangled states of optical 
field. By means of the instantaneous measurements of the quantum fluctuations of optical modes 
respectively distributed at sender and receiver, the random bits of secret key are obtained without 
the need for signal modulation. The post-selection boundaries for the presented entanglement- 
based scheme against both Gaussian collective and individual attacks are theoretically concluded. 
The final secret key rates of 84 kbits/s and 3 kbits/s are completed under the collective attack for 
the transmission efficiency of 80% and 40%, respectively. 
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Quantum key distribution (QKD) allows two legitimate 
parties, Alice and Bob, to establish the secret key only 
known by themselves. A secret key is usually generated 
by Alice transmitting the prepared quantum states to Bob, 
who performs measurements on the received states to dis- 
till the information. There are two types of QKD systems 
in which the discrete or continuous quantum variables are 
exploited, respectively. For discrete variable (DV) QKD 
protocols the key information is encoded in discrete quan- 
tum variables of single photon light pulse, such as po- 
larization or phase pQ. In continuous variable (CV) QKD 
protocols continuous quantum variables of light field, such 
as amplitude and phase quadratures, are used for trans- 
mitting information. Comparing with DV QKD of single 
photon schemes CV QKD promises significantly higher 
secret key rates and eliminates the need for single pho- 
ton technology. Recently, coherent state CV QKD proto- 
cols have been experimentally demonstrated PHS]- These 
successful experiments proved that CV QKD is a hope- 
ful and viable path to develop quantum cryptography for 
real-world applications. On the other hand the strictly 
theoretical proofs on the security of CV QKD protocols 
using both coherent and non-classical states of light have 
been achieved [7HTU]. CV QKD protocols have recently 
been shown to be unconditionally secure, that is, secure 
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against arbitrary attacks jllj and have been proved to be 
unconditionally secure over long distance [T2] , 

Quantum entanglement is one of the quite essential fea- 
tures in quantum mechanics that has no analogue in clas- 
sical physics. It has been theoretically demonstrated by 
Curty et al. that the presence of detectable entanglement 
in a quantum state effectively distributed between sender 
(Alice) and receiver (Bob) is a necessary precondition for 
successful key distillation [Tj3]. However, there is no CV 
QKD experiment directly utilizing optical entangled states 
to be presented until now, although a variety of theoreti- 
cal CV QKD protocols based on Einstein-Podolsky-Rosen 
(EPR) entanglement and squeezing of optical fields have 
been proposed [T4"H2T] . Not like CV QKD protocols ap- 
plying coherent states of light [2H2], m which the bits of 
secret key are constructed classically using amplitude and 
phase modulation, so-called prepare-and-measure (P&M) 
scheme [5], in the entanglement-based (EB) schemes pro- 
posed by refs. 16 and 17 the bits of the random secret 
key are constructed by the instantaneous measurements 
of the correlated quantum fluctuations of the quadratures 
between two entangled optical modes distributed at Alice 
and Bob. In the EB CV QKD protocols, the quantum fluc- 
tuations of entangled optical beams with the truly quan- 
tum randomness are utilized to generate the key. Due to 
that the classical signal modulation is not needed, the bit 
rates will not be limited by the rates of the electronic mod- 
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ulators and the experimental systems will be simplified. 

In the presented paper, we experimentally demon- 
strated the proof-of-principle CV QKD protocol using a 
pair of bright EPR entangled beams produced from a non- 
degenerate optical parametric amplifier (NOPA). We con- 
cluded the post-selection boundaries of the presented EB 
CV QKD scheme against both Gaussian collective and in- 
dividual attacks. By means of the post-selection, reconcili- 
ation and privacy amplification techniques, the final secret 
key was obtained through distilling the measured data of 
the correlated quantum fluctuations of quadratures. The 
generated raw key rate is 2 Mbits/s and the final secret key 
rates are 84 kbits/s and 3 kbits/s against Gaussian collec- 
tive attack for the transmission efficiency of 80% and 40%, 
respectively. We believe that this is the first experimental 
demonstration of CV QKD protocols directly exploiting 
the EPR entanglement of amplitude and phase quadra- 
tures of optical field. On the physical sense this exper- 
iment intuitionally shows the close relationship between 
the security of CV QKD and the quantum entanglement. 

The experimental setup of the CV QKD protocol is 
shown in fig. 1. The laser is a homemade continuous 
wave intracavity frequency-doubled and frequency stabi- 
lized Nd:YAP/KTP ring laser consisting of five mirrors 
|22) . The second harmonic wave output at 540 nm is used 
for the pump field of the NOPA and the fundamental wave 
output at 1080 nm is separated into two parts, one is for 
the injected signal of the NOPA and the other is used 
as the local oscillation beams of the homodyne detections 
for Alice and Bob. The NOPA consists of an a-cut type- 
II KTP crystal and a concave mirror. Through a para- 
metric down conversion process of type II phase match, a 
pair of EPR beams with anticorrelated amplitude quadra- 
tures and correlated phase quadratures may be produced 
from the NOPA operating in the state of de-amplification, 
that is, the pump field and the injected signal are out 
of phase [23]. The bandwidth of the NOPA is about 20 
MHz, in which the output beams are entangled. If dis- 
tributing the two beams of EPR pair to Alice (beam a) 
and Bob (beam b), the instantaneous measurement out- 
comes of quadrature quantum fluctuations on their respec- 
tive modes will be fairly identical due to the quantum cor- 
relations of quadratures |2~4"] . 

In the communication, Alice and Bob randomly measure 
the amplitude or phase quadrature of the entangled opti- 
cal beam they hold respectively, with the homodyne detec- 
tion systems. After the measurement is completed, they 
compare the measurement basis in the authorized classic 
channel and only remain the measurement results of the 
compatible basis. Then they use post-selection technique 
to select a subset from the measured raw data to make the 
mutual information of Alice and Bob advantage over Eve's 
information. To implement the post-selection, Alice pub- 
licly announce the absolute values of the measured ampli- 
tude or phase quadratures (\Xa \ or \Ya\), but not publicly 
open their symbols [J]. Alice and Bob also choose a ran- 
dom subset of data to characterize the channel efficiency 



Alice 



Laser 


54Cr;m 


NOPA 


1 S 1 in 



\ ,n V 



m 



Storage oscilloscope 



Quantum 
Channel 



Classical 
Channel 



Bob 




Storage oscilloscope 



Fig. 1: The experimental system of QKD. NOPA: non- 
degenerate optical parametric amplifier, ATT: attenuator, 
PBS: polarization beam splitter, LO: local oscillation beam, N: 
vacuum noise, PZT: piezoelectric transducer, BS: 50/50 beam 
splitter, D1-D4: photodetector, BPF: band-pass filter. 



and excess noise. From these values they select the secure 
data and discard the insecure data. After post-selection 
procedure, Alice and Bob interpret the post-selected data 
into binary data. For the correlated phase quadratures 
both Alice and Bob may define the positive and negative 
phase fluctuations as a binary "1" and "0", respectively. 
However for the anticorrelated amplitude quadratures if 
Alice define the positive (negative) amplitude fluctuation 
as "1" ("0"), Bob should defines negative (positive) am- 
plitude fluctuation as "1" ("0"). Then we apply the rec- 
onciliation protocol to correct the errors of the retained 
data. At last, we apply a privacy amplification procedure 
to distill the final secret key. 

In the security analysis we assume that the quantum 
channel connecting Alice and Bob is lossy with imper- 
fect transmittivity of rj and the Gaussian excess noise S 
on the quadrature distribution exists in the communica- 
tion system. The security analyses are restricted to pro- 
tect against Gaussian attacks only. For the optimal beam 
splitter attack [25], that is, Eve takes a fraction 1 — r\ of 
the beam b at Alice's site and sends the fraction r\ to Bob 
through her own lossless line. In this case Eve is totally 
undetected, and she gets the maximum possible informa- 
tion according to the no-cloning theorem. For collective 
attack, Eve listens to the communication between Alice 
and Bob during the key distillation procedure and then 
applies the optimal collective measurement on the ensem- 
ble of stored ancilla. The maximum information Eve may 
have access to is limited by the Holevo bound x 0- Un- 
der the individual attack, Eve measures the intercepted 
ensemble before the key distillation stage and Eve's infor- 
mation is summarized by the mutual information between 
Alice and Eve, Iae, for direct reconciliation. Generally, 
the information exchange is secure as long as the mutual 
information between Alice and Bob (Iab) is larger than 
Eve's information. The condition of Iab > Iae for ex- 
tracting secure key directly results in the restriction of 
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the maximum transmission losses less than 3 dB which 
will limit the possible transmission distances [25]. Fortu- 
nately, the 3 dB loss limit for CV QKD protocols can be 
beaten by implementing a reverse reconciliation scheme [2] 
or applying an appropriate post-selection It has 

been shown that there must be a lower limit of r\ (2r] > 8) 
for the secure key distillation if the excess noise exists 
[2"T] . The security of EB scheme against collective attack 
with reverse reconciliation has been proved |28j . Here, we 
analyze the post-selection boundary for the EB scheme 
against Gaussian collective attack and Gaussian individ- 
ual attack. 

For the EPR beams with anticorrelated amplitude 
quadratures and correlated phase quadratures, we have 
the following relations [28] : 
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((X a + X b ) 2 ) = {(Y a - Y b ) 2 ) = 2e~ 2r N 
(X a X b ) = -VV^lNo, 
(Y a Y b ) = VV^lNo, 



(1) 
(2) 
(3) 
(4) 



where r is the correlation parameter, No = 1/4 is the shot- 
noise-limited variance. These beam are entangled, and the 
measurement of a quadrature of beam a (e.g. Y a ) gives 
Alice information on the same quadrature of the other 
beam (Y&). By measuring the amplitude quadrature X a 
(phase quadrature Y a ) on her beam a, Alice learns Xa 
(Ya), and projects the Bob's beam b onto a X-squeezed 
(F-squeezed) state of squeezing parameter s = 1/V cen- 
tered on (X A , 0) [(0, Y A )] EH]- The best estimate Alice 
can have on Y b knowing Y a is of the form Ya = aY a with 
the value of a being found by minimizing the 
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variance of the error operator SYa = Y b — Ya- The con- 
ditional variance Vy b \ Ya °f Y b knowing Ya quantifies the 
remaining uncertainty on Y b after the measurement of Y a 
giving the estimate Ya of Y b , and we have 
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Since by measuring Y a Alice deduces Ya, and since Y b = 
Ya + SYa, the beam b is projected onto a F-squeezed state 
with squeezing variance V s = Vy b \YA ~ Nq/V centered 
on (0,Ya). Alternatively, by measuring X a , Alice learns 
Xa and projects the other beam onto a X-squeezed state 
centered on (Xa, 0) with the same squeezing variance V s = 
No/V. The variances of quadratures measured by Alice 
and Bob are V A = a 2 VN = (V - 1/V)N and V B = 
(t]Va + rjV s + 1 — r] + 5)Nq, respectively. 

The probability that Bob obtains the measurement out- 
come Yb is given by 
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where represents the transmitted quantum state, the 
noise variance 

v b = (vVs + 1 - V + 6) N of which depends 



on the squeezed variance r]V s N , the 'vacuum noise' com- 
ponent due to the line losses (1 — rj)No, and the 'excess 
noise' component 8 No- The corresponding Bob's error rate 
is given by 
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Based on eq. (7) we calculated the mutual information 
between Alice and Bob 



Iab = 1 +p\og 2 p+ (1 -p)log 2 (l -p). 



(8) 



For collective attack, Eve's knowledge of the data can 
be quantified by the Holevo bound x, which equals to [H| 
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where S(p) = —trp\og 2 p is the von Neumann entropy of 
a quantum state p. The \ includes that Eve being allowed 
to measure out her ancillas collectively. After Alice and 
Bob have corrected their bit stings, Eve can use the in- 
formation transmitted over the public channel to optimize 
her measurements on her ancilla systems. The quantum 
states in Eve's hand, conditioned on Alice's data, are given 
by \^i)e = | ± — rjty), where i = 0, 1 denote the en- 
coded binary state. These states are pure, so that we have 
X = S(p). What remains to be calculated are the eigen- 
values of p = ±(\^o)e (*o| + (*i|)- The symmetry 
allows us to write the states E as 



|*o) E = c |$o) +Cl |$l) 
|*i) B = co|*o)-ci|$i) 



(10) 



where the are orthonormal states. A short calculation 
shows that is already diagonal in this basis with eigenval- 
ues \ci\ 2 , so that the Holevo quantity is given by 



X = S(p) 
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^|c 4 | 2 log 2 | Cl | 
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(11) 



The normalization of p, \co\ 2 + \c\\ 2 ~ 1, and the overlap 
| Co | 2 — | cx | 2 =e (*o l^i)^ give the expressions for the 
coefficients, 



\c \ 2 = ^(1+e (*o|*i>b) 



(12) 



-(1 - E (*o|*1>b) 



The overlap of the two states can be calculated by 
|b(*o|*i)b| 2 = irfW(X,-Y)W(X,Y)dXdY if Y- 
quadrature is measured, where W(X, Y) is the Wigncr 
function of the projected squeezed states centered on 
(Xo,Yq). If Y-quadrature is measured by Alice, the cor- 
relation matrix of the projected V-squcczed state can be 
written as 

i r v o 

4 1/V 



v,. 



(13) 
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Using the expression of Wigner function for Gaussian 
states with one dimensional vector [3U] 

W(X,Y) = -^=^eM-kx,Y)[V c ]- 1 (X,Y) T }, 
27rvdet V c l 

(14) 

we can write out the corresponding Wigner function of the 
projected F-squeezed state 

W(X, Y) = l exp[- 4( 2 f ~ X £ - ^ + e^)(Y Y f] . 
it e zl + e a 

(15) 

If ^-quadrature are measured, then Eve's state is dis- 
placed to Y"o = \A — i]Ya, so the overlap between the two 
states W(X,Y) and W(X, —Y) is 

/ =e (*o|*i)s = exp[- (1 ~ 2 yjh (16) 

So, the Holevo quantity can be directly calculated. From 
eqs. (8) and (11), we can obtain the secret key rates K = 
Iab — X against collective attack. 

For the individual attack, the mutual information be- 
tween Alice and Eve is expressed by 

Tab = ^(l+ v / W I )log 2 (l + v / W 5 ) (17) 
+ ^(i- v / W 5 )log 2 (i-v / W 1 )- 

The secret key rate against individual attack is AI = 
Iab — Iae- Of course, the security boundary can also be 
directly applied to the anti-correlated amplitude quadra- 
ture X, for that we only need to change the signs of the 
measured amplitude values. 

In the communication, at first Alice separates the EPR 
entangled beams generated by the NOPA with a polarized 
beam splitter (PBS) and then sends one of them (beam 
b) to Bob while keeps the other one (beam a) within her 
own station. The beam b is transmitted in air about 2 me- 
ter. We simulated the QKD communication in two cases 
respectively with the transmission efficiency of 80% and 
40%, which were completed by inserting an appropriate 
attenuator into the optical path. For making the balance 
attenuation of two optical and implementing simultaneous 
measurements of the correlated quantum fluctuations, we 
insert an attenuator (ATT) with transmission efficiency 
89% or 45% into the optical path of the EPR beams be- 
fore they are separated. In addition to the detection ef- 
ficiency of 90%, the total transmission efficiency between 
Alice and Bob is 80% (89% x 90%) or 40% (45% x 90%), 
respectively. During the communication, Alice and Bob 
randomly and instantaneously measure the amplitude or 
phase quadratures of their own beam with a homodyne de- 
tection system, which is completed by randomly switching 
the phase difference between the local oscillation and the 
EPR beam from for the amplitude quadratures to 7r/2 
for the phase quadratures. The time interval At in which 
Alice and Bob switch the quadrature measurement is 5 ms 
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Fig. 2: The "global" perspective of Alice's and Bob's data. 

(a) , Amplitude quadrature for 80% transmission efficiency. 

(b) , Phase quadrature for 40% transmmision efficiency. I: 
post-selection boundary for collective attack. II: post-selection 
boundary for individual attack. Green data points: data that 
was error-free. Blue data points: data that has bit-flip errors. 
Red data points: data that has a negative net information rate. 



in our experiment. The long interval of 5 ms for switching 
the measurement bases was limited by the phase locking 
technology of the homodyne detection systems we held in 
the proof-of-principle experiment. Indeed, to ensure the 
security the time interval At should be as short as possible 
which should be only confined by the storage time of pho- 
tons in the NOPA (It equals to the reciprocal of optical 
cavity bandwidth. For our NOPA the minimal At m i n may 
reach ~ 5 x 10" 8 s in principle.). Of course, we also can 
enhance the security by lengthening the communication 
period to be much longer than At [3J • We choose the side- 
band frequency of Vt = 2 MHz as the centre frequency for 
Alice's and Bob's measurements because the highest en- 
tanglement is obtained at this frequency with our system. 
The measured initial correlation variances of the ampli- 
tude sum and phase difference between the signal and idler 
beams from the NOPA were 3.08 dB and 3.01 dB below 
the corresponding shot-noise-level (SNL) at 2 MHz, which 
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corresponding to the correlation parameter r = 0.355 and 
r = 0.347 for amplitude and phase quadratures, respec- 
tively. The output photocurrent from the negative power 
combiner (-) passes through a low-noise amplifier of 30 dB 
and a band-pass filter (BPF) with the central frequency of 
2 MHz and the bandwidth of 600 kHz, then it is recorded 
by a storage oscilloscope (Agilent 54830B) at Alice and 
Bob, respectively. The recorded data are transferred to 
a computer for the further data processing. Before the 
communication, Alice and Bob should synchronize their 
clocks and agree on the time interval At and the instan- 
taneous measurement time AT in which a data point is 
taken. Only when the instantaneous measurement time 
AT is longer than the storage time of the NOPA, the mea- 
sured correlations between the quadratures of signal and 
idler beams have a stable value [35]. The sample rate of 
10 MHz was chosen in the experiment. Since a band-pass 
filter is placed before the storage oscilloscope in order to 
extract the highly correlated quantum fluctuations, the 
real communication bandwidth is reduced. Thus, in the 
data processing we digitally re-sample the recorded data 
at 2 MHz (which corresponds to AT = 5 x 10" 7 s). 

After having recorded a string of data which include 
many data sets (each set is measured within a phase 
switching time interval of 5 ms), Alice and Bob commu- 
nicate through an authenticated public channel to discard 
the sets measured on the incompatible bases and to re- 
main the compatible measured sets corresponding to the 
same bases. The measured normalized variances of Alice's 
and Bob's amplitude quadratures are 6.78V and 7.02A r 
for 80% transmission efficiency, respectively Considering 
the influence of transmission efficiency, the variance mea- 
sured by Alice is V A > = (rjV A + 1 - v)N = 6.78V for 
the transmission efficiency 80%, so we have Va = 8.23Ao. 
Since V A = (V - 1/V)N and V s = N /V, we ob- 
tained V = 8.35A and V s = 0.12A . From V B = 
(tjVa + rjV s + 1 — ?/ + 6) No and Bob's variance value we ob- 
tained the corresponding excess noise of Si = 0.147Vo for 
80% transmission efficiency. In the same way, from the 
normalized variances of Alice's and Bob's phase quadra- 
tures 3.897Vo and 4.05^0 for 40% transmission efficiency, 
we calculated the excess noise of 5 2 = 0.11A . Fig. 2 
shows the "global" perspective of Alice's and Bob's re- 
sults measured on compatible bases, fig. 2 (a) shows the 
function of the amplitude quadratures (Xb vs Xa) for 
80% transmission efficiency and fig. 2 (b) shows that of 
the phase quadratures (Yg vs Ya) corresponding to 40% 
transmission efficiency. The anti-correlation of the ampli- 
tude quadratures (±A a ~ T-Xfc) and the correlation of the 
phase quadratures (±Y a ~ ±Y,) are clearly exhibited in 
the perspective. The quadrature measurements are nor- 
malized to the SNL of the measured beam. Each one of 
fig. 2 (a) and (b) contains 50,000 data points. 

For extracting the secure data of I A b > X ( Iab > Iae) 
from the measured raw data in the CV QKD, we used a 
post-selection technique, that is, to select a subset from 
the measured raw data points to make the mutual infor- 



mation of Alice and Bob advantage over Eve's informa- 
tion. According to the way described before, Alice and 
Bob select the secure data and discard the insecure data. 
The dashed hyperbolas I and II in fig. 2 correspond to 
the secure boundaries for collective attack and individual 
attack, respectively The regions at the outside of the hy- 
perbolas I (II) are secure K > (A/ > 0) for the collective 
(individual) attack, while the regions between the hyper- 
bolas are insecure (red points), the data in which should 
be discarded. The green data points correspond to error- 
free bits, whilst the blue data points correspond to that 
with bit-flip errors. 

After post-selection procedure, Alice and Bob interpret 
the post-selected data into binary data according to the 
way described above. Then we apply the "Cascade" recon- 
ciliation protocol [52| to correct the errors of the retained 
data. At the stage of the error correction, the data are ar- 
ranged into many random subsets and the error data are 
corrected. The efficiency of reconciliation is about 80%. 
At last, we apply a privacy amplification procedure based 
on universal hashing functions to distill the final secret 
key [5H[3S]. First, Alice and Bob calculate a conservative 
upper bound for Eve's knowledge about their key, then 
Alice and Bob compute the parities of random subsets 
of the error-corrected key bits. The obtained parity bits 
are kept as the final secret key. The results for different 
stages of the QKD protocol used to distill the secret key 
are shown in Table 1. The cost of these secret key dis- 
tillation processes is a reduction in the size of the secret 
key. With the existence of the Gaussian collective attack, 
after the privacy amplification procedure the final secret 
key rates of 84 kbits/s and 3 kbits/s are obtained for the 
transmission efficiencies of 80% and 40%, respectively. To 
the Gaussian individual attack only, the final secret key 
rates of 109 kbits/s and 10 kbits/s are obtained for the 
transmission efficiencies of 80% and 40%, respectively. 

In conclusion, we accomplished the first experimental 
demonstration of CV QKD protocol using the bright EPR 
entangled optical beams. The quantum entanglement be- 
tween two beams and the random quantum fluctuations 
of amplitude and phase quadratures of respective optical 
mode provide the physical mechanism for the CV QKD 
protocol without the signal modulation. The security of 
the EB CV QKD protocol against Gaussian collective and 
individual attack using post-selection technique is ana- 
lyzed. Although, as an example, the binary coding scheme 
is utilized for simplification, Alice and Bob can agree on a 
higher dimensional coding by dividing their results into in- 
tervals corresponding to more than two bits values, in prin- 
ciple. The presented CV QKD experiment intuitionally 
and directly demonstrated the importance of the quantum 
entanglement for the secure communication. It is possible 
to develop the more complicated CV QKD networks by 
using the multipartite CV optical entangled states based 
on this demonstrated scheme. 
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Table 1: Experimental results for the different stages of the QKD protocol used to distill the final secret key. Each step 
shows Alice and Bob's mutual information (Iab bits/symbol), Eve's information (x bits/symbol for collective attack and Iae 
bits/symbol for individual attack), the corresponding net information rate (K bits/symbol and AI bits/symbol) and the secret 
key rate (kbits/second) for 80% and 40% transmission efficiency, respectively. 
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